Security readout for executives and security teams
Plain-English summary
This flaw let a logged-in StackStorm user read datastore entries belonging to other users. For executives, the concern is unauthorized disclosure inside an automation platform, where datastore values may support operational workflows. The source does not provide a CVSS score or evidence of active exploitation.
Executive priority
Prioritize remediation for StackStorm systems that store secrets, credentials, or operational parameters in the datastore. The issue is authenticated and not known to be exploited, but unauthorized internal data exposure can create follow-on operational or credential risk.
Technical view
StackStorm API st2api before 2.9.2 and 2.10.x before 2.10.1 had incorrect access control on datastore key filtering. An authenticated API user could retrieve other users' datastore items. Enterprise editions with RBAC enabled are stated as unaffected.
Likely exposure
Exposure is limited to StackStorm deployments running affected st2api versions where an attacker already has a valid StackStorm account. Enterprise deployments with RBAC enabled are reported as not affected. The bundle does not identify affected CPEs or downstream packages.
Exploitation context
No KEV listing or cited source in the bundle indicates active exploitation. The vulnerability is not anonymous remote access; it requires authentication to the StackStorm API. Impact depends on what user-scoped datastore items contain and whether those values support sensitive automation.
Researcher notes
The public bundle is narrow: it describes the authorization bypass, affected version ranges, fixed releases, and RBAC exception. It does not include CVSS, CWE, detailed patch notes, exploit reports, or broad product metadata. Avoid expanding affected scope beyond StackStorm st2api.
Mitigation direction
- Upgrade StackStorm to 2.9.2, 2.10.1, or a later vendor-supported release.
- Confirm whether Enterprise RBAC is enabled if running an Enterprise edition.
- Review StackStorm vendor guidance for any additional release-specific remediation notes.
- Treat exposed datastore values as potentially disclosed and rotate sensitive values where appropriate.
Validation and detection
- Inventory StackStorm deployments and record st2api versions.
- Confirm whether any instance runs before 2.9.2 or 2.10.x before 2.10.1.
- Check whether Enterprise RBAC is enabled on Enterprise deployments.
- Review API audit logs for unusual datastore key access by authenticated users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20345 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-release/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.